package postgres

import (
	"context"
	"fmt"
	"time"

	"git.cin.su/m/Assistant/contracts/authority"
	"github.com/jackc/pgx/v5/pgxpool"
)

type AuthorityRepository struct{ pool *pgxpool.Pool }

func OpenAuthority(ctx context.Context, c ContinuityConfig) (*AuthorityRepository, error) {
	p, e := openPool(ctx, c)
	if e != nil {
		return nil, e
	}
	return &AuthorityRepository{p}, nil
}
func (r *AuthorityRepository) Close() { r.pool.Close() }
func (r *AuthorityRepository) LoadGrant(ctx context.Context, id authority.GrantID) (authority.AuthorityGrant, authority.Scope, error) {
	var grant authority.AuthorityGrant
	var scope authority.Scope
	err := r.pool.QueryRow(ctx, `SELECT g.grant_id, g.actor_id, g.principal_id, g.scope_id, g.grant_class, g.revision, g.active, s.scope_id, s.global_scope, s.label FROM authority.authority_grants g JOIN authority.scopes s ON s.scope_id=g.scope_id WHERE g.grant_id=$1`, id).Scan(&grant.ID, &grant.ActorID, &grant.PrincipalID, &grant.ScopeID, &grant.Class, &grant.Revision, &grant.Active, &scope.ID, &scope.Global, &scope.Label)
	if err != nil {
		return authority.AuthorityGrant{}, authority.Scope{}, fmt.Errorf("load authority grant: %w", err)
	}
	return grant, scope, nil
}

func (r *AuthorityRepository) LoadDelegatedControlPlaneGrant(ctx context.Context, id authority.GrantID) (authority.DelegatedControlPlaneGrant, error) {
	var grant authority.DelegatedControlPlaneGrant
	err := r.pool.QueryRow(ctx, `SELECT grant_id,service_actor_id,service_principal_id,issuer_principal_id,task_id,task_revision,operations,COALESCE(binding_id,''),COALESCE(provider_instance_id,''),COALESCE(model_descriptor_id,''),candidate_release_set_id,candidate_slot,candidate_capability_id,candidate_resource_scope,candidate_mode,candidate_target_kind,candidate_target_ref,candidate_target_digest,issued_at_unix_millis,expires_at_unix_millis,architecture_revision,nonce,revision,status FROM authority.delegated_control_plane_grants WHERE grant_id=$1`, id).Scan(&grant.ID, &grant.ServiceActorID, &grant.ServicePrincipalID, &grant.IssuerPrincipalID, &grant.TaskID, &grant.TaskRevision, &grant.Operations, &grant.Resource.BindingID, &grant.Resource.ProviderInstanceID, &grant.Resource.ModelDescriptorID, &grant.CandidateResource.ReleaseSetID, &grant.CandidateResource.Slot, &grant.CandidateResource.CapabilityID, &grant.CandidateResource.ResourceScope, &grant.CandidateResource.Mode, &grant.CandidateResource.TargetKind, &grant.CandidateResource.TargetRef, &grant.CandidateResource.TargetDigest, &grant.IssuedAtUnixMillis, &grant.ExpiresAtUnixMillis, &grant.ArchitectureRevision, &grant.Nonce, &grant.Revision, &grant.Status)
	if err != nil {
		return authority.DelegatedControlPlaneGrant{}, fmt.Errorf("load delegated control-plane grant: %w", err)
	}
	return grant, nil
}

func (r *AuthorityRepository) RecordDelegatedControlPlaneAudit(ctx context.Context, audit authority.DelegatedControlPlaneAudit) error {
	_, err := r.pool.Exec(ctx, `INSERT INTO authority.delegated_control_plane_audit (audit_id,grant_id,service_actor_id,service_principal_id,task_id,task_revision,operation,binding_id,provider_instance_id,model_descriptor_id,candidate_release_set_id,candidate_slot,candidate_capability_id,candidate_resource_scope,candidate_mode,candidate_target_kind,candidate_target_ref,candidate_target_digest,decision,outcome,recorded_at_unix_millis) VALUES ($1,$2,$3,$4,$5,$6,$7,NULLIF($8,''),NULLIF($9,''),NULLIF($10,''),$11,$12,$13,$14,$15,$16,$17,$18,$19,$20,$21)`, audit.AuditID, audit.GrantID, audit.ServiceActorID, audit.ServicePrincipalID, audit.TaskID, audit.TaskRevision, audit.Operation, audit.Resource.BindingID, audit.Resource.ProviderInstanceID, audit.Resource.ModelDescriptorID, audit.CandidateResource.ReleaseSetID, audit.CandidateResource.Slot, audit.CandidateResource.CapabilityID, audit.CandidateResource.ResourceScope, audit.CandidateResource.Mode, audit.CandidateResource.TargetKind, audit.CandidateResource.TargetRef, audit.CandidateResource.TargetDigest, audit.Decision, audit.Outcome, audit.RecordedAtUnixMillis)
	if err != nil {
		return fmt.Errorf("record delegated control-plane audit: %w", err)
	}
	return nil
}

func (r *AuthorityRepository) RevokeDelegatedControlPlaneGrant(ctx context.Context, id authority.GrantID, issuer string) (bool, error) {
	result, err := r.pool.Exec(ctx, `UPDATE authority.delegated_control_plane_grants SET status='REVOKED',revision=revision+1,revoked_at_unix_millis=$3 WHERE grant_id=$1 AND issuer_principal_id=$2 AND status='ACTIVE'`, id, issuer, time.Now().UnixMilli())
	if err != nil {
		return false, fmt.Errorf("revoke delegated control-plane grant: %w", err)
	}
	return result.RowsAffected() == 1, nil
}